PT-2026-2216 · Ghost · Ghost

Odgrso · Published 2026-01-08 · Updated 2026-01-15 · CVE-2026-22594

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ghost versions 5.105.0 through 5.130.5 Ghost versions 6.0.0 through 6.10.3

Description Ghost is a Node.js content management system. A flaw in Ghost’s 2FA mechanism permits staff users to bypass email 2FA. The issue affects the two-factor authentication process for staff users.

Recommendations Ghost version 5.105.0 through 5.130.5 should be updated to version 5.130.6. Ghost version 6.0.0 through 6.10.3 should be updated to version 6.11.0.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-GHOST-2026-22594

CVE-2026-22594

GHSA-5FP7-G646-CCF4

Affected Products

Ghost

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22594.json · Exploit
• https://github.com/TryGhost/Ghost/commit/b59f707f670e6f175b669977724ccf16c718430b · Patch
• https://github.com/TryGhost/Ghost/security/advisories/GHSA-5fp7-g646-ccf4 · Vendor Advisory
• https://github.com/TryGhost/Ghost/commit/fc7bc2fb0888513498154ec5cb4b21eccb88de07 · Patch
• https://osv.dev/vulnerability/CVE-2026-22594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22594 · Security Note
• https://osv.dev/vulnerability/GHSA-5fp7-g646-ccf4 · Vendor Advisory
• https://github.com/TryGhost/Ghost · Note
• https://twitter.com/cracbot/status/2011755306657989027 · Twitter Post
• https://twitter.com/TheHackerWire/status/2009828055234040029 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2009907676889653634 · Twitter Post
• https://twitter.com/CVEnew/status/2009837428345823620 · Twitter Post
• https://twitter.com/pulsepatchio/status/2010357384150188269 · Twitter Post